hard disk Drive problem

[ansarvm]

when i right click in any of my drives first appear Autoplay, i want to change the autoplay to open. pls help me.................

[TopFarmer]

What OS are you useing ? You talking about cd/dvd drives ?

[Jon Pwn]

Hardrives don't have an autoplay feature to begin with. What are you talking about?

[thaiiceland]

Hardrives don't have an autoplay feature to begin with

its true but there is some virus there that make this happend to the hard drive. I have the same problem and I don't know to get this back to normal. I have already cleaned the PC and did do that the help on my virusprogram told me to do (delet 2 registri entri, one make "Hacked By Codsilla" display on the Internet Explorer Titlebar, and the other one is deleting "MS32DLL.dll.vbs") The machine is clean but I still have this autorun on my Hard drive and I am trying to find a sulution how to get rid of it.

[thaiiceland]

It is caused by virus (I don’t remember the name, these virus names is never so easy to remember). But this same virus will put the text “Hacked By Godzilla” in the Title bar on IE.
After lot of searching I found information in Thai to fix this and I have at last fix my computer.
To start with you will have to go in tools (in any folder window) and select “Folder options” there you will click on “View” tap and there you will select “Show Hidden files and folders” and un hake “Hide protected operating system file” (this selections are important to find the files you need to delete).
You will then open Windows Task Manager (ctrl-alt-del) and select the “Processes” tap and find “wscript.exe” and click on “End Process” (if there is more than one process with that name you have to end all of them) after that you can close the “Task Manager”
Then you will click on start and select “Search” and search for “autorun.inf” (Search the computer) You will then delete all the files that contains the text MS32DLL.dll.vbs (the virus). (There of course should not be Autorun.inf in the C rooth). You will also delete the virus from the system (C:\WINDOWS\ MS32DLL.dll.vbs)
Next step is to edit the Register (Like always you have to be very care fool in the registry tools. Some mistake there can crash your computer)
Click on “Start” and select “Run” and type in “Regedit” and press “Enter”. Select HKEY_LOCAL_MACHINE --> Software -->Microsoft -->Windows --> Current Version --> Run. Find there “MS32DLL” and delete that entry.
Then select HKEY_CURRENT_USER --> Software --> Microsoft --> Internet Explorer --> Main. There you find “Window Title “Hacked by Godzilla”” and you should delete that entry. You can close the registry now.
Next you will click on Start --> Run and type in “gpedit.msc” and press “Enter”. Then you will open “Group Policy”. There you will select User Configuration --> Administrative Templates --> System --> and there you will double click on “Turn Off Autoplay” and in the window there you should select “Enabled” and select “All drives” (they say in this Thai webside that select all turn of Autoplay will be safer for not getting viruses). Now you can close the Group Policy.
Next you will click on Start --> Run and type “msconfig” and press “Enter”. You will open “System Configuration Utility”. Click on “Startup” tap and find the file MS32DLL take it out (this was written like this in Thai, only part that didn’t use the word Delete, but they probable mean that you have to delete the entry there. This entry wasn’t on my computer so I didn’t do anything there on my PC). Then you will exit the “System Configuration Utility” and select “Exit Without Restart” when prompt. After this you can open my Computer and select “Tools” and “Folder Options” and “View” tap to change back there. Select “Hide protected operating system file” and “Don’t show hidden files and folders”. Then you will empty the “Recycle bin” and “Restart” your computer. This helps me with my computer and I don’t get any “Autoplay” on my hard drive now.

[huehues]

hello Thaiiceland. You made the good post, and for that i got rid of Godzilla in my computer title bar. Thanks.

Below is just some little add-in on your post to make it a bit clearer (like SHIFT + DELETE.....) because some people will only press DELETE without SHIFT hence the Godzilla did not disappear(like my case )

Hope you don't mind i use your post to quote again,
HH

Originally Posted by thaiiceland

, "edited by hh" - It is caused by virus (I don’t remember the name, these virus names is never so easy to remember). But this same virus will put the text “Hacked By Godzilla” in the Title bar on IE.
After lot of searching I found information in Thai to fix this and I have at last fix my computer.

1-2. double click on My computer on Desktop ,
- choose Tool and select “Folder options”
- click on “View” tap select “Show Hidden files and folders” and un hake "Hide Extention...."
- and “Hide protected operating system file” (this selections are important to find the files you need to delete)
- then click "OK"

3. open Windows Task Manager (ctrl-alt-del) and select the “Processes” tap
- Click on "Image name" to sort File
- find “wscript.exe” and click on “End Process” (if there is more than one process with that name you have to end all of them)
- close the “Task Manager”

4. then you will click on Start and select “Search” and search for “autorun.inf” (Search the computer)
- you will then delete all the files that contains the text MS32DLL.dll.vbs (the virus) by pressing: SHIFT + DELETE. (There of course should not be Autorun.inf in the C rooth).

5. you will also delete the virus from the system (C:\WINDOWS\ MS32DLL.dll.vbs) by pressing: SHIFT + DELETE

6. Next step is to edit the Register (Like always you have to be very care fool in the registry tools. Some mistake there can crash your computer)

- first, click on “Start” and select “Run” and type in “Regedit” and press “Enter”.
- select HKEY_LOCAL_MACHINE --> Software -->Microsoft -->Windows --> Current Version --> Run.
- find there “MS32DLL” and delete that entry.

6. Then select HKEY_CURRENT_USER --> Software --> Microsoft --> Internet Explorer --> Main. There you find “Window Title “Hacked by Godzilla”” and you should delete that entry. You can close the registry now.

7. next you will click on Start --> Run and type in “gpedit.msc” and press “Enter”. then you will open “Group Policy”.
- there you will select User Configuration --> Administrative Templates --> System --> and there you will double click on “Turn Off Autoplay”

- in the window there you should select “Enabled” and select “All drives” (they say in this Thai webside that select all turn of Autoplay will be safer for not getting viruses). Now you can close the Group Policy.

8. Next you will click on Start --> Run and type “msconfig” and press “Enter”.
- you will open “System Configuration Utility”.
- click on “Startup” tap
- find the file MS32DLL, choose Enable All, then unhake "MS32DLL"
- click Apply then OK to close

- then you will exit the “System Configuration Utility” and select “Exit Without Restart” when prompt.

9. After this you double click on My Computer and select “Tools” and “Folder Options” and “View” tap to change back there.
- select "Hide Extention..." and “Hide protected operating system file” and “Don’t show hidden files and folders”.

- then you will empty the “Recycle bin” and “Restart” your computer.

This helps me with my computer and I don’t get any “Autoplay” on my hard drive now.

[tazir]

Just save the script as : fix-ms32.vbs
(the postfix is very important, don't save as text file - txt, or any another type, and use text program as Notepad etc. not MS Word).
After saving - just double-click on this file (Open / Execute).

You can recognized infected computer by the title "Hacked by Godzilla" at the end of Internet Explorer title. After execute the fixing script - I change this to: "Goodbye" (it's in the end of the script, you can change this with whatever you want).

The script is copyleft (http://www.gnu.org/copyleft/)

The script (in Blue color):


'Fix ms32dll.dll.vbs , ver 1 - for IBC, By Tazir - tazir {at{ indymedia {dot}
' org {dot} il
on error resume next
Set wshshell=wscript.CreateObject("WScript.Shell")
wshshell.Run "CMD /c TaskKill/F /im Wscript.exe /T"
wshshell.Run "TaskKill/F /im Wscript.exe /T"

Set fs=CreateObject("scripting.FileSystemObject")
myWinPath=fs.getSpecialFolder(0)
sFilePathAndName=myWinPath & "/ms32dll.dll.vbs"
If fs.FileExists(sFilePathAndName) = True Then
mf=fs.CreateTextFile(sFilePathAndName,true)
mf.attribute = 0
mf.WriteLine("")
mf.Close
fs.DeleteFile sFilePathAndName, True
end if
sFilePathAndName=myWinPath & "/autorun.inf"
If fs.FileExists(sFilePathAndName) = True Then
mf=fs.CreateTextFile(sFilePathAndName,true)
mf.attribute = 0
mf.WriteLine("")
mf.Close
fs.DeleteFile sFilePathAndName, True
end if

For Each fd in fs.drives
If (fd.DriveType=1 or fd.DriveType=2) and fd.path<>"A:" Then
sFilePathAndName=fd.path & "/ms32dll.dll.vbs"
If fs.FileExists(sFilePathAndName) = True Then
mf=fs.CreateTextFile(sFilePathAndName,true)
mf.attribute = 0
mf.WriteLine("")
mf.Close
fs.DeleteFile sFilePathAndName, True
end if
sFilePathAndName=fd.path & "/autorun.inf"
If fs.FileExists(sFilePathAndName) = True Then
mf=fs.CreateTextFile(sFilePathAndName,true)
mf.attribute = 0
mf.WriteLine("")
mf.Close
fs.DeleteFile sFilePathAndName, True
end if

end if
Next
Set fs=Nothing

oldVal=wshshell.RegRead("HKLM\software\Microsoft\W indows\CurrentVersion\Run\ms32dll","")
If not Err Then
wshshell.RegWrite "HKLM\software\Microsoft\Windows\CurrentVersion\Ru n\ms32dll",""
wshshell.RegDelete("HKLM\software\Microsoft\Window s\CurrentVersion\Run\ms32dll")
wshshell.RegWrite "HKCU\software\Microsoft\Internet Explorer\Main\Window Title","Goodbye"
End If

WScript.echo "Finish cleaning Virus ms32dll" & vbCrLf & "May all being be happy"
Set wshshell=Nothing

May all being be happy.

[tazir]

I forget - better to restart after the execute

[unaestrellacaid]

I made a system restore point on my computer then ran tazir's script late last night to test it out for a friend (I actually did not have the Hacked by Godzilla virus on my computer). Then, later someone else was using my computer and thought I had gotten a virus that added "Goodbye" to my IE title bar. I forgot that I had changed the additional window title to "Goodbye" by running his script. So then I turned off system restore (thinking I had a virus and not wanting to get my restore points infected) and proceeded to run every anti virus and anti spyware scan I could manage before realizing that the added "Goodbye" was not a virus at all but just the result of running this script. Unfortunately, because I deleted my restore point, I have no idea now how to return to the original settings for the IE Window title (without any addition dashes or words). I tried leaving this line blank (removing the word "Goodbye") at the end like this:

wshshell.RegWrite "HKCU\software\Microsoft\Internet Explorer\Main\Window Title"

but there is still a dash " - " there at the end of the IE title bar. For example, my current IE title bar reads:

Software Tips and Tricks Forum - Reply to Topic -

How do I get rid of any addition to the title bar completely? I find that dash very annoying.

Thanks for all the help on this forum. It really helped get rid of the Hacked by Godzilla virus effectively.

Peace

[sidfair]

Just go em internet options/contents/Auto-Complet/uncheck all boxes

Sorry if something is wrong about the names I am using my Windows Brasilian Versions

God Bye

[unaestrellacaid]

<< internet options/contents/Auto-Complet/uncheck all boxes >>

i tried this but it doesn't do anything to fix the problem. i think the fix would involve changing and re-running tazir's vbs script. in particular, this line:

wshshell.RegWrite "HKCU\software\Microsoft\Internet Explorer\Main\Window Title","Goodbye"

this adds the word "Goodbye" to the window title. if i remove it, it still leaves a dash " - ". how can i change it so i can get rid of the addition to the window title altogether?

anyone??

[eelke]

hi thanks everbody for advice on removal of godzilla,

thaiiceland and huehues gave extensive advice- but when I searched 'autorun.inf" nothing was found.

In any case, I found the following website:
http://www.able2know.com/forums/about87979.html

On this site mike (noteapot) put an autoremoval link which seems to have done the job! In any case, Godzilla seems to have disappeared for now.

http://www.softbkk.com/software/anti...ove_tools.html

cheers

Eelke

[keoicorp]

i was reading this and i had the same problem now.....the thing is i deleted the virus and i deleted the autorun thing for C and D of my hardrives but my H didn't have a autorun thing now when i double click the H drive it says script error MS32DLL.dll.vbs missing.

anyone know what i can do..i really don't want to formate it too much things in there i need 96 gigs to back up is well alot... also when i deleted the auto run thing in my C and D it worked fine but H didn't have one and it needs a script thing please help me T_T

[mirali]

when i right click in any of my drives first appear Autoplay, i want to change the autoplay to open. pls help me, when i double click a drive on my computer it says cannot find script file ms32dll.dll.vbs pls help me......

[mirali]

When i right click in any of my drives first appear Autoplay, i want to change the autoplay to open. And when i double click a drive on my computer it says "cannot find script file ms32dll.dll.vbs" pls help me......

Thanks
Mirali